Technical Notes TN 1 - ETG FactoryCast Gateway TSX ETG 3021 / 3022 modules. How to Setup a GPRS Connection?

Transcription

1 FactoryCast Gateway TSX ETG 3021 / 3022 modules How to Setup a GPRS Connection? 1

2 2

3 Table of Contents 1- GPRS Overview... 4 Introduction... 4 GPRS overview... 4 GPRS communications... 4 GPRS connections... 5 Notes on GPRS contracts... 5 GPRS performance Setup Methodology... 7 Setup Methodology Hardware Setup... 8 SIM card installation GPRS Setup GPRS modem Setup Opening a GPRS connection via internal register Opening GPRS connection via Call back Working with Dynamic GPRS IP addresses Dynamic GPRS IP addresses overview VPN Security Overview VPN security overview VPN services Notes on VPN client interfaces VPN Security Setup Setting up VPN security Using Windows VPN client utility Using Thegreenbow VPN client software Related VPN configuration in ETG302x setup

4 1- GPRS Overview Introduction This technical note describes How to setup a GPRS connection with the TSX ETG 302x modules. GPRS Communications are available on TSX ETG 302x modules (V1.1 version) TSX ETG 3021 : 900 / 1800 MHz band TSX ETG 3022 : 850 / 1900 MHz band GPRS provides a cost effective solution for wireless permanent remote connections to distributed installations :Remote programming, remote monitoring and maintenance NOTE: This document only explains the main steps to follow to setup and open a GPRS connection with VPN security. For more detailed information, please refer to the User Manual documentation for the related topics GPRS overview GPRS (General Packet Radio Service) is a Packet oriented Data Service based on GSM technology. (Global System for Mobile). Main advantages over GSM and PSTN: Communications cost : Data transfer is typically charged per amount of data exchanged (amount of megabytes per month), while data communication via traditional circuit switching is billed per minute of connection time. GPRS allows continuous / permanent remote connections Higher Data rates than GSM > Theoretically GPRS communications In GPRS, communications are done through the internet and so connections are established differently as GSM or PSTN. During a GPRS connection, ETG302x module connects to the GPRS network via an Access Point Name (APN) given by the GPRS service provider Access Point Name (APN) realizes the bridge between the GPRS network and the internet The client PC or application is also connected to the internet. Therefore to ensure a secure remote access, the ETG302x modules also implements security 4

5 services such as VPN (Virtual Private Network) or IP filtering Data encryption capabilities GPRS communications require a SIM card and a specific GPRS subscription / contract provided by a GPRS service Provider In GPRS, connections are always established from modem to GPRS network, and never from GPRS network to modem. It is not possible for a client application to open a connection by dialing the ETG302x directly as in PSTN. However the ETG 302x module accepts incoming GSM or PSTN calls and supports Internet Call back function in order to connect itself to the GPRS network from a remote request. ETG 302x modules provides two modes for connecting to GPRS network : Permanent mode: - Automatically connection at startup or after a boot or after a connection loss On Demand mode: - on a process or application condition. (via internal registers) - via Call back function GPRS connections The GPRS connections are done to an Access Point Name (APN) given by the GPRS service provider. The ETG302x module then receives an IP address from the provider either a Public IP or a PRIvate IP address either a Static IP or a Dynamic IP address depending on the GPRS subscription. Note: We recommend to choose subscriptions with: Public APN with public IP address (visible from internet) Static IP address (get rid of DynDNS or IP publication) ETG302x supports both Static or Dynamic IP addresses. For Dynamic IP addresses, ETG 302x provides DynDNS support Notes on GPRS contracts GSM/GPRS service providers are offering dedicated subscriptions well adapted to industrial applications, also called M2M (Machine to Machine) subscriptions. Various GPRS subscriptions are available with different options: various different Data exchange rates (billing on data amount in Megabytes per month) option for Static IP or Dynamic IP address Incoming TCP ports blocked or not blocked : some providers are offering only subscriptions with TCP ports, blocked for security reasons, for instance ports lower than port 1024 may be blocked Note: We recommend to choose subscriptions with: Public APN with public IP address (visible from internet) a Static IP address and no TCP ports blocked in order to lower remote connection constraints and benefits of the routing services of ETG302x. 5

6 GPRS performance Wireless Generations: Theoretical Rates GPRS Connection Speed Typical Rates GPRS is a technology in which speed is a direct function of : Connection and signal quality relative to distance to a transceiver station (determines Coding scheme- CS) Current network traffic condition from provider: gives how many TDMA (Time division multiple access ) time slots are assigned (ie: 3 in download+2 in upload, or 4 in download +1 in upload) 6

7 2- Setup Methodology Setup Methodology This section describes the main steps to follow to setup GPRS communications and VPN security Step I II III IV V VI VII VIII IX X XI XII XIII Actions Get a GPRS contract / subscription from a GPRS service provider with a SIM card and activate the SIM card Insert the SIM card inside the back of the ETG302x module and connect the antenna Connect a PC to the ETG302x module with an Ethernet cable Open an Internet browser and access ETG302x Web site, enter Setup Web pages Open Modem Setup page and configure PIN code via Reboot the module and verify SIM configuration and GSM signal Configure GPRS parameters via Modem Setup page and Reboot module Verify GPRS connection status: Open an Internet browser, and access ETG302x Diagnostic Web pages with the Ethernet cable Connect the PC to the Internet, after removing the Ethernet cable from the ETG module Access to the ETG302x module using GPRS IP address to open ETG Web site. (only for contracts with no TCP ports blocked by provider) Optional: Configure the VPN service in Tunnel mode (For contracts with TCP ports blocked or for accessing Ethernet devices connected to the ETG 302x ) On the ETG side, Configure VPN parameters via VPN security Setup page, and Reboot module (VPN tunnel mode) On the PC side, Open a VPN client software or Run a Windows VPN client utility batch file. (VPN tunnel mode) Connect to the ETG 302x via the VPN tunnel 7

8 3 - Hardware Setup SIM card installation This section describes how to install and setup SIM card in an ETG302x module Step Action 1. Power off the ETG 302x module and connect the GSM antenna 2. Insert the SIM card inside the back of the ETG302x module after removing the backplane NOTE: Pay attention to the sense of the card 3. Power on the ETG 302x module 4. Connect a PC to the Ethernet port of the ETG 302x module PC installation Pre-requisite: Web Designer software installation A Java Virtual Machine (JVM) must be installed on the PC. o We recommend to install the JVM V1.4.02_14 from SUN provided in the CD ROM delivered with the module 8

9 5. Open an Internet Browser (Internet Explorer) and enter IP address of ETG302x In the "Address" field enter the URL: ETG_IP_address>, then Enter. Result: The Home page appears on the screen. Note: For the first connection to the module enter the Factory_default IP address of the ETG302x module. The Factory_default IP address is derived from the MAC address of the module, printed on the front panel It has the following format : xxx.yyy, where xxx and yyy represents the last two digits of the MAC address converted to decimal format. Example: If the MAC address of the module (in hexadecimal format) is: F , In this case, the default IP address (in decimal format) is: Your PC has to be in the same IP address range based upon the subnet mask. 6. Click on Setup in the Menu bar of the Home page 9

10 The configuration menu appears on the left part of the Setup Web page. NOTE: Hardware module configuration can be done either via Setup Web pages embedded in the module or via Web Designer software. 7. If you want to modify the Factory_default IP address of the module, Select IP Configuration menu Enter the desired IP address and subnet mask value according to your network configuration. For instance enter: IP= , Subnet mask= >> Click on Apply button Select Control menu and Reboot the module to let it get the new IP address configured! Click on apply and enter Configuration password in Upper case = USER (by default) 8. In the Internet Browser enter now the new IP address you just have configured, for instance , then press Enter. Click on Setup in the Menu bar and Select Modem configuration menu 10

11 9. Enter carefully the PIN code of your SIM card. >> Click on Apply button and Reboot the module Note: Type the PIN code of the SIM card carefully: if you enter an incorrect PIN code 3 times, the SIM card will be locked. If it happens, call your GPRS service provider to unlock it. 10. After reboot, you can check if the PIN code is taken into account Enter the Diagnostic pages by selecting the Diagnostic menu and select Modem Diagnostic Select Modem Diagnostic and verify SIM card information, signal level, etc 11

12 4 - GPRS Setup GPRS modem Setup This section describes how to setup the GPRS modem configuration You can configure the GPRS modem connection to be open via the following options: Permanent mode: Automatically at module startup On Demand mode: o via the Call back function o by forcing to 1 the internal register of the module %MW Click on Setup in the Menu bar and Select Modem configuration menu Select GPRS enable check box and enter the GPRS parameters: Connection mode: We recommend to start with On Demand option Access Point Name ( APN ) : Enter the APN according to you GPRS provider and contract. APN must be Public APN to be accessed from Internet Username/Password of the APN >> Click on Apply button and Reboot the module Opening a GPRS connection via internal register This section describes how to Open GPRS connection by writing to 1 the internal register 1001 of the module (Command register for open/close modem connection) This command can be done by a Human action: via the Data Editor page or a graphic page of the ETG 302x Web site (via a Web browser) Process condition: via a PLC request to write this register directly in the ETG 302x, in runtime on an event 12

13 1. Enter the Monitoring pages by clicking the Monitoring menu and select Data Editor Lite. Create a new data table, by clicking the following icon Then double click in the table to create a new line and edit a data access Fill in the fields: for two registers Unit Id = 255, register Address = Command register for open/close modem connection (open = 1, close = 2) Unit Id = 255, register Address = Status register for modem connection (connection in progress = -1, command OK = 0) Then click on the start animation icon and enter the value = 1 enter the Write access password in Upper case = USER (by default) 2. The GPRS connection is now established to the APN of your provider and to the Internet! You can now check if the GPRS connection is done. Enter the Diagnostic pages by selecting the Diagnostic menu and select Modem Statistics or Log file. 13

14 Connection status is displayed in the Modem Diagnostics screen. NOTE : If you have a GPRS account with Dynamic IP address, you can read the IP address given by the provider for this connection. (Local PPP address field) or Log file screen 3. You can now try to access the ETG302x module address via Internet by a ping to the IP address of the module by opening an internet browser and connect to the module using its IP address. NOTE: This access via Internet is possible if the conditions described below are fulfilled : You have a contract with no TCP ports blocked *** if you are connected to the internet without access restriction (company firewall) ***TCP ports blocked: You have a contract with TCP ports blocked, you cannot access to the ETG module HTTP server (port 80). See VPN section 14

15 Opening GPRS connection via Call back This section describes how to Open GPRS connection by setting up the Call back function: the Call back function allows you to dial the ETG 302x module with its GSM phone number. The ETG302X module will hang-up after a number of ring and connect to the GPRS network. 1. Click on Setup in the Menu bar and Select Modem configuration menu Select the Call back enable Check box >> Click on Apply button and Reboot the module 2. You can now Dial the ETG 302x module via its GSM phone number (from SIM card). The ETG302X module will hang-up after a number of ring and connect to the GPRS network. 3. After connection verification, You can try to access the ETG302x module address via Internet by a ping to the IP address of the module by opening an internet browser and connect to the module using its IP address. NOTE: This access via Internet is possible if the conditions described below are fulfilled : You have a contract with no TCP ports blocked *** if you are connected to the internet without access restriction (company firewall) ***TCP ports blocked: You have a contract with TCP ports blocked, you cannot access to the ETG module HTTP server (port 80). In this case, in order to access to the ETG module and devices, you must setup the VPN service, see related section 15

16 5 - Working with Dynamic GPRS IP addresses Dynamic GPRS IP addresses overview This section describes how to Work with Dynamic GPRS IP addresses. For more information refer to User manual documentation. If you have got a Dynamic GPRS IP address with your GPRS subscription, it is changed / renewed frequently by your service provider. ETG 302x provides two solutions to work with Dynamic GPRS IP addresses: DynDNS service for the IP address Publication: o you can configure the DynDNS IP publication service in order to access the ETG302x module using a DynDNS name instead of an IP address which is Dynamic and is changed frequently by the provider. Publication of the IP address: o Configure an service using Web Designer software to send the new IP address to the end user application. (refer to the user manual ) o 1. We support DynDNS name server provided by DynDNS.com company. You have first to create an account to the Web site. 2. To create an account, visit the Web site. (For more information refer to the user manual ) 3. Once you have created your DynDNS account, you will have to register the ETG302x devices and eventually you PC with specific names such as: myetg1.dyndns.org, myetg2.dyndns.org, mypc1.dyndns.org 4. You can now configure the IP publication service Click on Setup in the Menu bar and Select Modem configuration menu Enter the IP publication parameters 16

17 5. DynDNS behaviour on ETG Side After connecting to GPRS, the ETG302x module will register to the DynDNS server and maintain the link between the GPRS Dynamic IP address and the DNS name myetg1.dyndns.org for instance. The ETG module will be be accessible via its URL myetg1.dyndns.org instead of its Dynamic IP address. Note: You can ping the URL myetg1.dyndns.org to know the current dynamic IP address given by the provider to the module. 17

18 6 - VPN Security Overview VPN security overview This section describes how to Set-up VPN (Virtual Private Network) service Using VPN security service, ETG302x can establish secure connections via private, bidirectional, encrypted tunnels over the Internet between the central sites and your remote equipment. Important Note: VPN setup (tunnel mode) is mandatory for benefiting of routing capabilities from WAN to LAN for accessing transparently to devices connected behind an ETG 302x gateway. VPN security provides: Secured connections between PC connected to Internet and remote ETG302x gateways, bringing remote devices 'virtually' into your own LAN. Once the tunnel mode is established, your programming software and monitoring tools access the remote device transparently, as if it are in the same local network. Secured Site-to-Site Connections via VPN tunnels between two remote ETG302x gateways. Any device from one site can access any other device in the remote site. This capability can also be useful for instance as alternative solution for replacing leased lines between sites. The VPN service is based on IPSec protocols*** (Internet Protocol Security) for creating secured tunneled connections. IKE (Internet Key Exchange) for session authentication with pre-shared key exchange 18

19 VPN services ETG302x support VPN / IPSec with the following services: Tunnel mode: In tunnel mode the entire IP packet (data plus the message headers) are encrypted and/or authenticated, Tunnel mode is used for network-to-network communications Transport mode: In transport mode, only the payload (the data you transfer) of the IP packet is encrypted and/or authenticated. Transport mode is used for host-to-host communications. Data authentication : different level from SHA to MD5 provided by AH protocol (Authentication header) Data encryption : different level from 3DES encryption to DES lite encryption provided by ESP protocol (Encapsulating Security Payload) Notes on VPN client interfaces When connecting a PC to a remote ETG 302x, the ETG302x acts as a VPN server. It is necessary to run a VPN client interface on the client (PC or other ETG302x) side. When connecting an ETG302x client to a remote ETG 302x the ETG302x client can act as a VPN client. ETG302x VPN setup includes this client configuration. Various VPN client can be used: VPN client service provided by Windows operating systems XP, 2000, Vista (we provide sample batch files to run this service under Windows operating systems) thegreenbow.com VPN client software (validated and recommended) 19

20 7 - VPN Security Setup Setting up VPN security This section describes how to Setup VPN security services The advantages of using VPN tunnel are: Transparent access to all Ethernet devices below the gateway as if they are in the same LAN as your PC Use of the local LAN IP addresses (ETG side). (Get rid of using GPRS IP addresses) 11. Click on Setup in the Menu bar and Select PPP security menu Select the VPN enable Check box Enter the VPN parameters: Remote address Pre shared Key Mode : Tunnel or Transport (we recommend to use Tunnel mode for transparent routing to Ethernet devices) >> Click on Apply button and Reboot the module Using Windows VPN client utility This section describes how to use Windows VPN client batch file. Prerequisite: IPSEC service must be installed and enabled on your PC. If this is not the case, please install Windows Support tools that will add IPSEC service 20

21 VPN client batch files samples for Windows (XP, 2000, Vista) are provided inside the CD ROM of the ETG 302x. 12. Customize the provided Batch file to match your application requirements in term of : Network address to access (eg: * ) VPN Client & server Addresses (eg: etg1.dyndns.org, pc1.dyndns.org) VPN mode Tunnel or Transport Encryption level Preshared key (must match the one configured in the ETG 302x VPN setup page) Example of batch command for VPN tunnel from PC to ETG: ipseccmd -1s 3DES-SHA-2 -n AH[MD5] -f 0= * -t etg1.dyndns.org -a PRESHARE:"etg1presharedkey" p "ETGTunnel" -r "PCToTarget" -1k 3600s -w reg -x Example of batch command for VPN tunnel from ETG to PC: ipseccmd -1s 3DES-SHA-2 -n AH[MD5] -f *=0 t pc1.dyndns.org -a PRESHARE:"etg1presharedkey" -p "ETGTunnel" -r "TargetToPC" -1k 3600s -w reg x Note: For more details please read User Manual documentation Using Thegreenbow VPN client software This section describes how to use the Thegreenbow VPN client software. The Thegreenbow VPN client software has been validated with ETG 302x modules et we recommend to use it as a VPN client. In order to use this VPN client software you have to purchase it on the following Web site VPN client software. 1. Once installed on you PC, you can use Thegreenbow VPN client to launch a VPN tunnel between your PC and the remote ETG 302x module. Note: For more details please read User Manual documentation The VPN client software allows you to configure the following parameters: Remote ETG address (ie. Etg3.dyndns.org) Pre shared key (must match the one configured in the ETG 302x VPN setup page) Encryption level 21

22 2. First panel Set Remote ETG address (ie. Etg3.dyndns.org) Set Pre shared key (set same in ETG VPN configuration) Set IKE encryption Second panel Set Encryption level Set Tunnel / transport mode Virtual Client Address: Use and set same in ETG VPN configuration Open Tunnel connection 22

23 Related VPN configuration in ETG302x setup Set Remote PC address Set Pre shared key (set same in ETG VPN configuration) Set Tunnel / transport mode Virtual Client Address: Use same as TheGreenbow VPN client configuration 23